latentbot | 8028313f8ccc23c6cb1b07927d5e3a5e5aff66f36f2ce67be49cb96372722d76

Resubmissions

24-01-2025 23:14

250124-27yspavnbr 7

24-01-2025 23:02

250124-21dtyavkap 10

19-01-2025 16:29

250119-tzgv7swkcv 10

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FiveMHackV2.exe
Size

26.2MB
MD5

0a80c7be4e77b4b2f9e580c26a0b5d13
SHA1

7525eaf2118d893c6a73fa5471f6adea4e75e164
SHA256

8028313f8ccc23c6cb1b07927d5e3a5e5aff66f36f2ce67be49cb96372722d76
SHA512

362cb3f5306cb978bc7d8e7240023c9f859a9907a07b03df4756ea48b02c0b68ddf751719b13027bd2447d9b2d1d598e210c744c4b4e1bcc11d9d17b783a1169
SSDEEP

786432:SKP9F8JjEdm7SJtWqwkd7q+XlR43OnDgUd4Z+c:P7qEdm7SHWqwGxXX43cDgUd4ZV

Score

10^/10

latentbot njrat mybot discovery evasion persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

147.185.221.25:12821

Mutex

4ce4232fc398063865fce10fcca4f582

Attributes

reg_key
4ce4232fc398063865fce10fcca4f582
splitter
Y262SUCZ4UJJ

Extracted

Family

latentbot

nikomklkahba.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2928	netsh.exe
1468	netsh.exe
1316	netsh.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aa238bbbf6c461548a622535aabe462.exe	Windows Defender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aa238bbbf6c461548a622535aabe462.exe	Windows Defender.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c3b6f282e0a1f239e3d9037ed996682d.exe	Windows Defender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c3b6f282e0a1f239e3d9037ed996682d.exe	Windows Defender.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ce4232fc398063865fce10fcca4f582.exe	Windows Services.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4ce4232fc398063865fce10fcca4f582.exe	Windows Services.exe

Executes dropped EXE 13 IoCs

pid	Process
2380	FiveM Hack V1.exe
2988	CheatEngine75.exe
2396	CheatEngine75.tmp
2644	Client.exe
2392	Windows Services.exe
464	Setup.exe
2912	Windows Defender.exe
2248	Rename_Z60IHLDjO6.exe
1204	FiveM Hack.exe
2976	FiveM Hack.exe
1248	Process not Found
2708	Setup.exe
2576	Windows Defender.exe

Loads dropped DLL 18 IoCs

pid	Process
2328	FiveMHackV2.exe
2988	CheatEngine75.exe
2396	CheatEngine75.tmp
2396	CheatEngine75.tmp
2644	Client.exe
464	Setup.exe
2380	FiveM Hack V1.exe
2956	Process not Found
2380	FiveM Hack V1.exe
1204	FiveM Hack.exe
2976	FiveM Hack.exe
2976	FiveM Hack.exe
2976	FiveM Hack.exe
2976	FiveM Hack.exe
2976	FiveM Hack.exe
2976	FiveM Hack.exe
2976	FiveM Hack.exe
2708	Setup.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c3b6f282e0a1f239e3d9037ed996682d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Defender.exe\" .."	Windows Defender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\4ce4232fc398063865fce10fcca4f582 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Services.exe\" .."	Windows Services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4ce4232fc398063865fce10fcca4f582 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Services.exe\" .."	Windows Services.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\4aa238bbbf6c461548a622535aabe462 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender.exe\" .."	Windows Defender.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4aa238bbbf6c461548a622535aabe462 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender.exe\" .."	Windows Defender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\c3b6f282e0a1f239e3d9037ed996682d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows Defender.exe\" .."	Windows Defender.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a49c-193.dat	upx
behavioral1/memory/2976-195-0x000007FEF62E0000-0x000007FEF68C8000-memory.dmp	upx
behavioral1/memory/2976-198-0x000007FEF62E0000-0x000007FEF68C8000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine75.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Defender.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CheatEngine75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows Defender.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	Windows Services.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: SeDebugPrivilege	2912	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: SeDebugPrivilege	2576	Windows Defender.exe
Token: 33	2576	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2576	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2576	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2576	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2576	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2576	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2576	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2576	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2576	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2576	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2576	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2576	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2576	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2576	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe
Token: SeIncBasePriorityPrivilege	2392	Windows Services.exe
Token: 33	2576	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2576	Windows Defender.exe
Token: 33	2912	Windows Defender.exe
Token: SeIncBasePriorityPrivilege	2912	Windows Defender.exe
Token: 33	2392	Windows Services.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	CheatEngine75.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2380	2328	FiveMHackV2.exe	31
PID 2328 wrote to memory of 2380	2328	FiveMHackV2.exe	31
PID 2328 wrote to memory of 2380	2328	FiveMHackV2.exe	31
PID 2380 wrote to memory of 2988	2380	FiveM Hack V1.exe	32
PID 2380 wrote to memory of 2988	2380	FiveM Hack V1.exe	32
PID 2380 wrote to memory of 2988	2380	FiveM Hack V1.exe	32
PID 2380 wrote to memory of 2988	2380	FiveM Hack V1.exe	32
PID 2380 wrote to memory of 2988	2380	FiveM Hack V1.exe	32
PID 2380 wrote to memory of 2988	2380	FiveM Hack V1.exe	32
PID 2380 wrote to memory of 2988	2380	FiveM Hack V1.exe	32
PID 2988 wrote to memory of 2396	2988	CheatEngine75.exe	33
PID 2988 wrote to memory of 2396	2988	CheatEngine75.exe	33
PID 2988 wrote to memory of 2396	2988	CheatEngine75.exe	33
PID 2988 wrote to memory of 2396	2988	CheatEngine75.exe	33
PID 2988 wrote to memory of 2396	2988	CheatEngine75.exe	33
PID 2988 wrote to memory of 2396	2988	CheatEngine75.exe	33
PID 2988 wrote to memory of 2396	2988	CheatEngine75.exe	33
PID 2380 wrote to memory of 2644	2380	FiveM Hack V1.exe	34
PID 2380 wrote to memory of 2644	2380	FiveM Hack V1.exe	34
PID 2380 wrote to memory of 2644	2380	FiveM Hack V1.exe	34
PID 2380 wrote to memory of 2644	2380	FiveM Hack V1.exe	34
PID 2644 wrote to memory of 2392	2644	Client.exe	35
PID 2644 wrote to memory of 2392	2644	Client.exe	35
PID 2644 wrote to memory of 2392	2644	Client.exe	35
PID 2644 wrote to memory of 2392	2644	Client.exe	35
PID 2380 wrote to memory of 464	2380	FiveM Hack V1.exe	36
PID 2380 wrote to memory of 464	2380	FiveM Hack V1.exe	36
PID 2380 wrote to memory of 464	2380	FiveM Hack V1.exe	36
PID 2380 wrote to memory of 464	2380	FiveM Hack V1.exe	36
PID 2380 wrote to memory of 464	2380	FiveM Hack V1.exe	36
PID 2380 wrote to memory of 464	2380	FiveM Hack V1.exe	36
PID 2380 wrote to memory of 464	2380	FiveM Hack V1.exe	36
PID 464 wrote to memory of 2912	464	Setup.exe	37
PID 464 wrote to memory of 2912	464	Setup.exe	37
PID 464 wrote to memory of 2912	464	Setup.exe	37
PID 464 wrote to memory of 2912	464	Setup.exe	37
PID 2392 wrote to memory of 2928	2392	Windows Services.exe	38
PID 2392 wrote to memory of 2928	2392	Windows Services.exe	38
PID 2392 wrote to memory of 2928	2392	Windows Services.exe	38
PID 2392 wrote to memory of 2928	2392	Windows Services.exe	38
PID 2380 wrote to memory of 2248	2380	FiveM Hack V1.exe	40
PID 2380 wrote to memory of 2248	2380	FiveM Hack V1.exe	40
PID 2380 wrote to memory of 2248	2380	FiveM Hack V1.exe	40
PID 2380 wrote to memory of 1204	2380	FiveM Hack V1.exe	42
PID 2380 wrote to memory of 1204	2380	FiveM Hack V1.exe	42
PID 2380 wrote to memory of 1204	2380	FiveM Hack V1.exe	42
PID 1204 wrote to memory of 2976	1204	FiveM Hack.exe	43
PID 1204 wrote to memory of 2976	1204	FiveM Hack.exe	43
PID 1204 wrote to memory of 2976	1204	FiveM Hack.exe	43
PID 2912 wrote to memory of 1468	2912	Windows Defender.exe	44
PID 2912 wrote to memory of 1468	2912	Windows Defender.exe	44
PID 2912 wrote to memory of 1468	2912	Windows Defender.exe	44
PID 2912 wrote to memory of 1468	2912	Windows Defender.exe	44
PID 2328 wrote to memory of 2708	2328	FiveMHackV2.exe	46
PID 2328 wrote to memory of 2708	2328	FiveMHackV2.exe	46
PID 2328 wrote to memory of 2708	2328	FiveMHackV2.exe	46
PID 2328 wrote to memory of 2708	2328	FiveMHackV2.exe	46
PID 2328 wrote to memory of 2708	2328	FiveMHackV2.exe	46
PID 2328 wrote to memory of 2708	2328	FiveMHackV2.exe	46
PID 2328 wrote to memory of 2708	2328	FiveMHackV2.exe	46
PID 2708 wrote to memory of 2576	2708	Setup.exe	47
PID 2708 wrote to memory of 2576	2708	Setup.exe	47
PID 2708 wrote to memory of 2576	2708	Setup.exe	47
PID 2708 wrote to memory of 2576	2708	Setup.exe	47

C:\Users\Admin\AppData\Local\Temp\FiveMHackV2.exe
"C:\Users\Admin\AppData\Local\Temp\FiveMHackV2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\FiveM Hack V1.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FiveM Hack V1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\CheatEngine75.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\CheatEngine75.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\is-1ML88.tmp\CheatEngine75.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1ML88.tmp\CheatEngine75.tmp" /SL5="$301EC,2335682,780800,C:\Users\Admin\AppData\Local\Temp\RarSFX1\CheatEngine75.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2396
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\Windows Services.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows Services.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Windows Services.exe" "Windows Services.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2928
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Users\Admin\AppData\Roaming\Windows Defender.exe
      "C:\Users\Admin\AppData\Roaming\Windows Defender.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2912
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Windows Defender.exe" "Windows Defender.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1468
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Rename_Z60IHLDjO6.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Rename_Z60IHLDjO6.exe"
    3⤵
    - Executes dropped EXE
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\FiveM Hack.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\FiveM Hack.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\FiveM Hack.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\FiveM Hack.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2976
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Windows Defender.exe" "Windows Defender.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe

Filesize
23KB

MD5
441b7bb82f8ca1c5b2b68c696f46c87b

SHA1
c05ee7eb6b5412435367ed4a52d9e390610d0369

SHA256
5f297f9ecde481a518ec9e2c00d91b63cdec6f034d1e5c4160db0c6c00b1b3c8

SHA512
88941f238f03604cfae0dd5a6493928366cada1b4a81edb181e6369fb12ea79641d393ecc602f3e67e84e4d87d06748d0bdca32e1636cc22e1140a1e857f5b60

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\CheatEngine75.exe

Filesize
3.1MB

MD5
609fea742d34dc1d53f0eeb4873b1a0a

SHA1
3232c52da3cb8f47a870162a35cdd75fcae60aea

SHA256
e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e

SHA512
27da89901268d153fd7158162fc8f2f3b99ec9a4aa24c281f93b500466552af776b00f0a33182386a62934c3e553561cbc23d3f5ebb0ea0366c04e046e1bcc90

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Client.exe

Filesize
31KB

MD5
fcbf5b75ec9a1d8b94ba124211ddfcd4

SHA1
b332dbc86f5b4ad20b4f6346f839ded949e5e48c

SHA256
90acd35563ad1b3bbb0b20b8e390eb1b43f39a02397fdfe69738fbd98d9d749d

SHA512
9cfef0a42ec78376a988c421c9350d097895dadf9e5f85833d22c29e17818fd17552278aae5e1f704e4703544d3d7caaab0fd69944c8fcc60e2019760928a6f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe

Filesize
23KB

MD5
716ba39c8bd18c0951556f003a3e0265

SHA1
9e1b07c0b856e79578819ba0189f612c318e5397

SHA256
a48829328e55cdc5eb657cf372c680a1ffee282b25503997ef1aa00948ae6d6c

SHA512
f654b52c049d64aee9019ca33c235dc9c50f8d4bfbec1e74a3cd5d0f0530573b01ca8db7518379d8a10675e1234bf8bb349a3b5196ca184d9e3b6ad0b81a239c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12042\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12042\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12042\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12042\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI12042\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VOQO2.tmp\logo.png

Filesize
258KB

MD5
6b7cb2a5a8b301c788c3792802696fe8

SHA1
da93950273b0c256dab64bb3bb755ac7c14f17f3

SHA256
3eed2e41bc6ca0ae9a5d5ee6d57ca727e5cba6ac8e8c5234ac661f9080cedadf

SHA512
4183dbb8fd7de5fd5526a79b62e77fc30b8d1ec34ebaa3793b4f28beb36124084533e08b595f77305522bc847edfed1f9388c0d2ece66e6ac8acb7049b48ee86

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\FiveM Hack V1.exe

Filesize
25.9MB

MD5
ff96f2cc9bb0e983f2cc7507e4ef2ac9

SHA1
4bd152be16651f69db0df76e7af0024f9ebf28d5

SHA256
a09a8265d885b78ba09912dd4a5531ff1754989ed9424b8e33e0b1a404215e37

SHA512
bc5c0abfd7dc7bb0db83c2c1cd87f6514f9bf5da5ed7036e64d80baae97828d4417432128cf96a274bf359c0c8d267e77e48793f10deffd2aa6b62569136e863

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\FiveM Hack.exe

Filesize
7.7MB

MD5
ba7b34118537e3039ca82869140ed975

SHA1
c2d32b0570cb42fd0c23610b1514a4655783ba10

SHA256
22f6bc2477f06b718b25cb73b8446a80b27d1f8d389b7629a87c8c65fb51416c

SHA512
9c7a1b84b118c5bd95147e9822c4a8c9bbf9f1a08d9acf50e42b53a20718aaf72c4a388d93c31027b8d1552230ba2c05c3b5b7191e05833e416fed0cb34b56a5

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\Rename_Z60IHLDjO6.exe

Filesize
37.2MB

MD5
62b8cb69f7c3ce2c5a843a8fa66b580f

SHA1
5f0440dface4bb25bbe3ee0a7dc7223b36eca37a

SHA256
8c586ec7de39427fa8fc2480c10eb2e04728793e2033e3103ed140f1b4cfb535

SHA512
ffc19d8d3f5cd6be99065203e5fc59ad993122c9bab91c243f62390e2aff6b710a63fe0c84776822fcd5ab195eb6cfa94ed7275d0ba336d50fa32afb26141e9c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12042\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12042\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
\Users\Admin\AppData\Local\Temp\is-1ML88.tmp\CheatEngine75.tmp

Filesize
2.9MB

MD5
1cdbf6da4defe32c9cb5908968a02fab

SHA1
d1a5eb2928d718d7a1517187f523c701c141b659

SHA256
87c1bb2236a874c97369b2cca0d55559fa917707cebddf7a5eabc691f8302487

SHA512
215697cae7ec2ba27fbc0b9208cb8676e27d21e55e0184fc68cbd1c1bd57863daf29348ea677e97af84628800ba15e6db884df872c3adc673a3cd7faed2888b9

Download Submit
\Users\Admin\AppData\Local\Temp\is-VOQO2.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
\Users\Admin\AppData\Local\Temp\is-VOQO2.tmp\zbShieldUtils.dll

Filesize
2.0MB

MD5
fad0877741da31ab87913ef1f1f2eb1a

SHA1
21abb83b8dfc92a6d7ee0a096a30000e05f84672

SHA256
73ff938887449779e7a9d51100d7be2195198a5e2c4c7de5f93ceac7e98e3e02

SHA512
f626b760628e16b9aa8b55e463c497658dd813cf5b48a3c26a85d681da1c3a33256cae012acc1257b1f47ea37894c3a306f348eb6bd4bbdf94c9d808646193ec

Download Submit
memory/2396-61-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2396-50-0x0000000002A80000-0x0000000002A8F000-memory.dmp

Filesize
60KB

Download
memory/2396-62-0x0000000002A80000-0x0000000002A8F000-memory.dmp

Filesize
60KB

Download
memory/2396-71-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/2976-195-0x000007FEF62E0000-0x000007FEF68C8000-memory.dmp

Filesize
5.9MB

Download
memory/2976-198-0x000007FEF62E0000-0x000007FEF68C8000-memory.dmp

Filesize
5.9MB

Download
memory/2988-29-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2988-73-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2988-60-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2988-32-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads